Sign-up

ID

VAR-202109-1223


CVE

CVE-2021-37191


TITLE

SINEMA Remote Connect Server  Vulnerability related to interaction frequency control in

Trust: 0.8

sources: JVNDB: JVNDB-2021-011705

DESCRIPTION

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could brute force the usernames from the affected software. The platform is mainly used for remote access, maintenance, control and diagnosis of the underlying network. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.88

sources: NVD: CVE-2021-37191 // JVNDB: JVNDB-2021-011705 // CNVD: CNVD-2021-71423 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-399022 // VULMON: CVE-2021-37191

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-71423

AFFECTED PRODUCTS

vendor:siemensmodel:sinema remote connect serverscope:ltversion:3.0

Trust: 1.0

vendor:siemensmodel:sinema remote connect serverscope:eqversion:3.0

Trust: 1.0

vendor:シーメンスmodel:sinema remote connect serverscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:sinema remote connect serverscope:eqversion:3.0 sp2

Trust: 0.8

vendor:siemensmodel:sinema remote connect server sp2scope:ltversion:v3.0

Trust: 0.6

sources: CNVD: CNVD-2021-71423 // JVNDB: JVNDB-2021-011705 // NVD: CVE-2021-37191

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-37191
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-37191
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2021-71423
value: LOW

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202109-929
value: MEDIUM

Trust: 0.6

VULHUB: VHN-399022
value: LOW

Trust: 0.1

VULMON: CVE-2021-37191
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2021-37191
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-71423
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-399022
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-37191
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2021-37191
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-71423 // VULHUB: VHN-399022 // VULMON: CVE-2021-37191 // JVNDB: JVNDB-2021-011705 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-929 // NVD: CVE-2021-37191

PROBLEMTYPE DATA

problemtype:CWE-799

Trust: 1.1

problemtype:Improper control of interaction frequency (CWE-799) [ others ]

Trust: 0.8

sources: VULHUB: VHN-399022 // JVNDB: JVNDB-2021-011705 // NVD: CVE-2021-37191

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202109-929

TYPE

other

Trust: 1.2

sources: CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-929

PATCH

title:SSA-334944url:https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf

Trust: 0.8

title:Patch for Vulnerability of improper control of interaction frequency in Siemens SINEMA Remote Connect Serverurl:https://www.cnvd.org.cn/patchInfo/show/290886

Trust: 0.6

title:Siemens SINEMA Remote Connect Server Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=163667

Trust: 0.6

title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=beb2786961a935a883573ee5ef3c7caa

Trust: 0.1

sources: CNVD: CNVD-2021-71423 // VULMON: CVE-2021-37191 // JVNDB: JVNDB-2021-011705 // CNNVD: CNNVD-202109-929

EXTERNAL IDS

db:NVDid:CVE-2021-37191

Trust: 4.0

db:SIEMENSid:SSA-334944

Trust: 2.4

db:ICS CERTid:ICSA-21-257-19

Trust: 1.4

db:JVNid:JVNVU96712416

Trust: 0.8

db:JVNDBid:JVNDB-2021-011705

Trust: 0.8

db:CNVDid:CNVD-2021-71423

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021091614

Trust: 0.6

db:CNNVDid:CNNVD-202109-929

Trust: 0.6

db:VULHUBid:VHN-399022

Trust: 0.1

db:VULMONid:CVE-2021-37191

Trust: 0.1

sources: CNVD: CNVD-2021-71423 // VULHUB: VHN-399022 // VULMON: CVE-2021-37191 // JVNDB: JVNDB-2021-011705 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-929 // NVD: CVE-2021-37191

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-37191

Trust: 1.4

url:https://jvn.jp/vu/jvnvu96712416/

Trust: 0.8

url:https://www.cisa.gov/uscert/ics/advisories/icsa-21-257-19

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021091614

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-257-19

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/799.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://cert-portal.siemens.com/productcert/txt/ssa-334944.txt

Trust: 0.1

sources: CNVD: CNVD-2021-71423 // VULHUB: VHN-399022 // VULMON: CVE-2021-37191 // JVNDB: JVNDB-2021-011705 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-929 // NVD: CVE-2021-37191

CREDITS

Sharon Brizinov from Claroty reported these vulnerabilities to Siemens.

Trust: 0.6

sources: CNNVD: CNNVD-202109-929

SOURCES

db:CNVDid:CNVD-2021-71423
db:VULHUBid:VHN-399022
db:VULMONid:CVE-2021-37191
db:JVNDBid:JVNDB-2021-011705
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202109-929
db:NVDid:CVE-2021-37191

LAST UPDATE DATE

2024-08-14T13:13:29.017000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-71423date:2022-01-18T00:00:00
db:VULHUBid:VHN-399022date:2021-09-23T00:00:00
db:VULMONid:CVE-2021-37191date:2021-09-23T00:00:00
db:JVNDBid:JVNDB-2021-011705date:2022-08-09T02:38:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202109-929date:2021-09-24T00:00:00
db:NVDid:CVE-2021-37191date:2021-09-23T19:13:36.877

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-71423date:2021-09-15T00:00:00
db:VULHUBid:VHN-399022date:2021-09-14T00:00:00
db:VULMONid:CVE-2021-37191date:2021-09-14T00:00:00
db:JVNDBid:JVNDB-2021-011705date:2022-08-09T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202109-929date:2021-09-14T00:00:00
db:NVDid:CVE-2021-37191date:2021-09-14T11:15:26.013